WebSession: escape invalid login form parameters
WebSession: escape invalid login form parameters

* Escape login form parameters in many places in order to avoid XSS.

* Plugged a simple version of login_method washer.

* Escaped some action names and values in warning messages.

inveniosoftware/invenio-access,tiborsimko/invenio-access,tiborsimko/invenio-access,inveniosoftware/invenio-access